[alsa-devel] KASAN tool mem leak issue

[Takashi Iwai]

On Thu, 28 Dec 2017 07:43:36 +0100,
b_lkasam at codeaurora.org wrote:
> 
> hi ALSA team,
> Recently when running KASAN on our devices,
> we found below KASAN failure wrt uninitialized mem access(or null-ptr
> deref) in file sound/core/timer.c.
> 
> And our codebase already have this fix
> https://www.spinics.net/lists/alsa-devel/msg63410.html
> Seems issue is still present, please help check and comment.
> 
> Let me know if you need any other inputs.

Could you check whether 4.15-rc kernel still shows the issue?
Judging from the line number in sound/core/timer.c, the code you're
testing isn't the latest one, and some fixes might be missing.


Takashi

> 
> Observed Result:-
> ==================================================================
> sde_rotator ae00000.qcom,mdss_rotator: <SDEROT_WARN> invalid ioctl
> type c040563d
> sde_rotator ae00000.qcom,mdss_rotator: <SDEROT_WARN> invalid ioctl
> type 4c81
> BUG: KASAN: null-ptr-deref in copy_to_user
> arch/arm64/include/asm/uaccess.h:398 [inline]
> BUG: KASAN: null-ptr-deref in snd_timer_user_read+0x33c/0x458
> sound/core/timer.c:2010
> Read of size 32 at addr           (null) by task syz-executor/2171
> sde_rotator ae00000.qcom,mdss_rotator: <SDEROT_WARN> invalid output
> format 0x00000000 7x2305
> CPU: 6 PID: 2171 Comm: syz-executor Tainted: G    B   W  O    4.9.65+ #1
> Hardware name: Qualcomm Technologies, Inc. SDM670 PM660 + PM660L MTP
> (DT)
> Call trace:
> [<ffffff9ed988d390>] dump_backtrace+0x0/0x428
> arch/arm64/kernel/traps.c:76
> [<ffffff9ed988d7e0>] show_stack+0x28/0x38 arch/arm64/kernel/traps.c:226
> [<ffffff9ed9e2d9b8>] __dump_stack lib/dump_stack.c:15 [inline]
> [<ffffff9ed9e2d9b8>] dump_stack+0xd4/0x124 lib/dump_stack.c:51
> [<ffffff9ed9b1d77c>] kasan_report_error mm/kasan/report.c:345 [inline]
> [<ffffff9ed9b1d77c>] kasan_report.part.2+0xdc/0x2f0
> mm/kasan/report.c:371
> [<ffffff9ed9b1df44>] kasan_report+0x5c/0x70 mm/kasan/report.c:372
> [<ffffff9ed9b1c434>] check_memory_region_inline mm/kasan/kasan.c:301
> [inline]
> [<ffffff9ed9b1c434>] check_memory_region+0x12c/0x1c0
> mm/kasan/kasan.c:315
> [<ffffff9ed9b1c4e0>] kasan_check_read+0x18/0x20 mm/kasan/kasan.c:320
> [<ffffff9edad44144>] copy_to_user arch/arm64/include/asm/uaccess.h:398
> [inline]
> [<ffffff9edad44144>] snd_timer_user_read+0x33c/0x458
> sound/core/timer.c:2010
> [<ffffff9ed9b425e0>] __vfs_read+0xe0/0x2a0 fs/read_write.c:452
> [<ffffff9ed9b43e68>] vfs_read+0xb8/0x1c0 fs/read_write.c:475
> [<ffffff9ed9b461d4>] SYSC_read fs/read_write.c:591 [inline]
> [<ffffff9ed9b461d4>] SyS_read+0xcc/0x170 fs/read_write.c:584
> [<ffffff9ed9883f70>] el0_svc_naked+0x24/0x28
> ==================================================================
> 
> Thank You,
> Laxminath Kasam
> _______________________________________________
> Alsa-devel mailing list
> Alsa-devel at alsa-project.org
> http://mailman.alsa-project.org/mailman/listinfo/alsa-devel
>